Add a member_list permission to allow or deny viewing of the full member list

crm/include/member/install.inc.php

@@ -78,8 +78,8 @@ function member_install($old_revision = 0) {
             , '8' => 'webAdmin'
         );
        $default_perms = array(
-            'member' => array('member_view', 'member_membership_view')
-            , 'director' => array('member_plan_edit', 'member_view', 'member_add', 'member_edit', 'member_delete', 'member_membership_view', 'member_membership_edit')
+            'member' => array('member_list', 'member_view', 'member_membership_view')
+            , 'director' => array('member_list', 'member_plan_edit', 'member_view', 'member_add', 'member_edit', 'member_delete', 'member_membership_view', 'member_membership_edit')
         );
         foreach ($roles as $rid => $role) {
             if (array_key_exists($role, $default_perms)) {

crm/include/member/member.inc.php

@@ -45,6 +45,7 @@ function member_permissions () {
         , 'contact_edit'
         , 'contact_delete'
         , 'member_plan_edit'
+        , 'member_list'
         , 'member_view'
         , 'member_add'
         , 'member_edit'

crm/include/member/page.inc.php

@@ -119,6 +119,13 @@ function member_page (&$page_data, $page_name, $options) {
                 return;
             }
 
+            // Disallow access if neccessary
+            // TODO: maybe add a nice error message
+            if (!user_access('member_list') && $_GET['cid'] != user_id()) {
+                page_set_title($page_data, "Error");
+                return;
+            }
+
             // Set page title
             page_set_title($page_data, theme('member_contact_name', $cid));
 

crm/include/member/table.inc.php

@@ -82,6 +82,12 @@ function member_table ($opts = NULL) {
 
     // Loop through member data
     foreach ($members as $member) {
+
+        // If the user does not have member_list access, disallow listing
+        // for all members other than its own user
+        if (!user_access('member_list') && $member['cid'] != user_id()) {
+            continue;
+        }
 
         // Add user data
         $row = array();